A Simple Guide To Bit Banged I2C On The 6502

June 18, 2023 by Dave Rowntree 5 Comments

We covered [Anders Nielsen]’s 65duino project a short while ago, and now he’s back with an update video showing some more details of bit-banging I²C using plain old 6502 assembly language.

Obviously, with such a simple system, there is no dedicated I²C interface hardware, so the programmer must take care of all the details of the I²C protocol in software, bit-banging it out to the peripheral and reading back the response one bit at a time.

The first detail to concern us will be the I²C addresses of the devices being connected to the bus and how low-level bit manipulation is used to turn the 7-bit I²C address into the byte being bit-banged. As [Anders] shows, setting a bit is simply a logical-OR operation, and resetting a bit is a simple logical-AND operation using the inversion (or one’s complement) bit to reset to form a bitmask. As many will already know, this process is necessary to code for a read or a write I²C operation. A further detail is that I²C uses an open-collector connection scheme, which means that no device on the bus may drive the bus to logical high; instead, they must release the drive by going to the high impedance state, and an external pull-up resistor will pull the bus high. The 6532 RIOT chip (used for I/O on the 65unio) does not have tristate control but instead uses a data direction register (DDR) to allow a pin to be an input. This will do the job just fine, albeit with slightly odd-looking code, until you know what’s going on.

From there, it’s a straightforward matter to write subroutines that generate the I²C start, stop, and NACK conditions that are required to write to the SSD1306-based OLED to get it to do something we can observe. From these basic roots, through higher-level subroutines, a complete OLED library in assembly can be constructed. We shall sit tight and await where [Anders] goes next with this!

We see I²C-connected things all the time, like this neat ATtiny85-based I²C peripheral, and whilst we’re talking about the SSD1306 OLED display controller, here’s a hack that shows just how much you can push your luck with the I²C spec and get some crazy frame rates.

Continue reading “A Simple Guide To Bit Banged I2C On The 6502” →

Interlaken Want To Connect All The Chips

April 17, 2023 by Al Williams 11 Comments

One of the problems with designing things on a chip is finding a good way to talk to the outside world. You may not design chips yourself, but you care because you want to connect your circuits — including other chips — to the chips in question. While I2C and SPI are common solutions, today’s circuits are looking for more bandwidth and higher speeds, and that’s where Interlaken comes in. [Comcores] has an interesting post on the technology that blends the best of SPI 4.2 and XAUI.

The interface is serial, as you might expect. It can provide both high-bandwidth and low-latency multi-channel communications. Interlaken was developed by Cisco and Cortina Systems in 2006 and has since been adopted by other industry-leading companies. Its latest generation supports speeds as high as 1.2 Tbps.

Continue reading “Interlaken Want To Connect All The Chips” →

Digital Replica Of Antique Weather Monitoring Instrument

February 22, 2023 by Bryan Cockfield 8 Comments

Computers and digital sensors have allowed for the collection and aggregation of data barely possible to imagine to anyone in the instrumentation scene even sixty years ago. Before that, things like weather stations, seismometers, level sensors, and basically any other way of gathering real data about the world would have been performed with an analog device recording the information on some sort of spool of paper. This was much more tedious but the one thing going for these types of devices was their aesthetic. [mircemk] is back to bring some of that design inspiration to a digital barometric display.

The barometer is based around an Arduino Arduino Nano and a relatively large I2C display to display the captured data. It also uses a BME 280 pressure sensor board, but the technical details of this project are not the focal point here. Instead, [mircemk] has put his effort in recreating the old analog barographs, which display barometric data on a spool of paper over time, on the I2C display. As the device measures atmospheric pressure, it adds a bar to the graph, displaying the data over time much as the old analog device would have.

We’ve discussed plenty of times around here that old analog meters and instrumentation like this recreation of a VU meter are an excellent way of getting a more antique aesthetic than is typically offered by digital replacements. Adding in a little bit of style to a project like this can go a long way, or you can simply restore the original antique instead.

A modchip described in the article - a small PCB with an epoxy blob on it, soldered to the Cisco switch PCB using four thin wires

Counterfeit Cisco Hardware Bypasses Security Checks With Modchips

February 1, 2023 by Arya Voronova 32 Comments

Some pictures recently surfaced on social media, showing a small PCB tapped into four points on Cisco-branded boards. What is this about? A NSA backdoor so data can be exfiltrated to some third party? Well, that’s theoretically possible, but it’s actually used for bypassing hardware authenticity checks in Cisco hardware being cloned — a sizable industry. Of course, “can’t believe it’s not Cisco” hardware is only valuable insofar that it’s able to run the Cisco software, and that’s where the bodge boards play a major role.

A 2020 report by F-Secure details an investigation, comparing three switches marked as Cisco 2960X – one known genuine and two known counterfeits. The counterfeits had the aforementioned implants either soldered to the bottom of the PCB or added to the board as a separate component, and the paper goes into why they’re important for successful counterfeiting.

Apparently, these chips emulate or bypass an I2C EEPROM containing part of the code executed during the boot sequence, and Cisco depends on this EEPROM’s contents for authenticity verification. Cisco software reads the EEPROM twice — once for verification, and once again for actually running it. The microcontroller included on the mod board can return a genuine binary with a valid signature on the first read, and a binary with hardware checks patched out for subsequent reads.

The paper will tell you about way more than this — it’s thorough yet captivating. As you’d expect, it devotes quite a bit of time to comparing genuine and counterfeit boards, showing that the cloning process is pretty to-the-T, save for some part substitutions. For instance, check out the PDF page 12 to see how via locations are exactly copied between PCBs in a bizarre way, or the Cisco file format and authenticity check analysis closer to the end of the report. All in all, the 38 pages of the document make for a fun foray into what makes Cisco authentication mechanisms tick, and what helps clone hardware makers bypass them.

Are such chips ever used for adding backdoors and data exfiltration? There’s no evidence of that, as much as that’s not to be excluded — bypassing anti-cloning protections would make other hijinks more viable no doubt, that said, only hardware authentication bypass measures were found so far. This mechanism also breaks during software updates, and absolutely, leaves some to be desired when it comes to its stated functionality. That said, such fun insights can help us, say, enforce right-to-repair, enable hardware reuse, and thwart many predatory business practices in areas where laws fail us.

Dead Washer Lives Again With ATTiny

January 11, 2023 by Al Williams 59 Comments

We aren’t saying that appliances are a scam, but we have noticed that when your appliances fail, there’s a good chance it will be some part you can no longer get from the appliance maker. Or in some cases, it’s a garden-variety part that should cost $2, but has been marked up to $40. When [Balakrishnan] had a failure of the timer control board for a Whirlpool washing machine, it was time to reverse engineer the board and replace it with a small microcontroller.

Of course, this kind of hack is one of those that won’t help you unless you need exactly that timer board. However, the process is generally applicable. Luckily, the motherboard chip was documented and the timer control board used a simple ATmega88, so it was easy to see that the devices were communicating via I2C.

Reading the I2C bus is easy with a logic analyzer, and this revealed the faulty device’s I2C address. The board that failed was only for display, so a simple program that does nothing other than accept I2C data put the washer in working order. Once it was working with an Arduino, an ATTiny45 did the work with a lot less space and cost.

If you don’t want to reverse engineer the washing machine, you could just replace all the controls. That even works if the old washer wasn’t electronic to start.

Working With I2S-Compatible FM Tuners

December 23, 2022 by Lewin Day 9 Comments

While the Internet is a great place to get access to any music or audio you can dream of, there’s still a place for broadcast radio. [mit41301] has recently been exploring implementing a simple FM tuner chip in various projects.

The chip in question is the RDA7088, which is designed to require the bare minimum in external components, and is available in a compact SOP16 package. As per the datasheet, it was intended for use in applications like portable radios, PDAs, cell phones, and MP3 players.

[mit41301]’s first attempt involved using the chip as a simple tuner, hooked up to a PIC10F200 for control. Investigation revealed it was capable of outputting digital audio via I2S, while being commanded via I2C. By default, it spits out audio at a low sample rate of 8 kHz, but reconfiguration will jump that up to 44.1 or 48 kHz. Piping that digital I2S stream out to a DAC then delivers analog output that can be fed to an amplifier. The build also got remote control, with the PIC handling decoding IR signals and outputting commands to the radio chip.

Following this success, [mit41301] then went further, hooking up an ESP-01 to the chip to try and get RDS going. If you’re unfamiliar with the Radio Data System, it’s a way for short textual messages to be sent out by FM broadcasters. In addition to the duties carried out by the PIC module, the ESP-01 is also charged with receiving RDS data from the RDA7088, and outputting it to a display.

While using such chips is routine in industry, it’s always great to see a DIY guide to interfacing with specific hardware. If you want to integrate FM radio into your own projects, the RDA7088 is a simple and easy way to do so. We’ve seen similar work before, adding FM radio to the Raspberry Pi.

Continue reading “Working With I2S-Compatible FM Tuners” →

Two hands holding a 3d printed alarm clock with an LCD display, snooze button and knob on top

IO Connected Radio Alarm Clock

December 19, 2022 by Abe Connelly 3 Comments

[CoreWeaver] creates an alarm clock that includes features one might expect in such a project, including an FM radio, snooze button inputs and a display, but goes beyond the basic functionality to include temperature sensing and a PC connection, opening the way for customizable functionality.

An Atmega328 is used for the main microcontroller which communicates via I2C both to a DS1307 real time clock (RTC) and a TEA5767 FM module. The main power comes from a 9V power source with an LM317 and LM7805 linear regulators providing a 3.3V and 5V power rail, respectively. Most of the electronics are powered using 5V except for the TEA5767, which is powered from the 3.3V rail and has its I2C communication levels shifted from 5V to 3.3V. The audio output of the TEA5767 feeds directly into the TDA7052 audio amplifier to drive the speakers. Since the RTC has an auxiliary coin cell battery for power, the alarm clock can keep accurate time even when not plugged in. Continue reading “IO Connected Radio Alarm Clock” →